Swiss SME Cyber Alert: Nextcloud – Collabora app is being actively exploited
A critical vulnerability in Nextcloud’s optional “Collabora Online – Built-in CODE Server” app is being actively exploited. An unauthenticated attacker can run operating-system commands as the web-server user, but only while the built-in CODE server is not running, such as during a restart, upgrade or crash. If your organisation runs Nextcloud itself or through an IT provider, ask them to check the app version and look for signs of compromise now.
What happened?
Collabora published its advisory for CVE-2026-110447 on 14 October 2026. Attacks against internet-accessible Nextcloud installations had already been observed from 10 September 2026, including the installation of PHP web shells and subsequent commands on affected servers.
The vulnerability has a CVSS v4.0 score of 9.2. Successful exploitation runs commands with the privileges of the web-server user and can therefore expose data and secrets accessible to that service.
Could my organisation be affected?
The issue affects Nextcloud installations using the optional “Collabora Online – Built-in CODE Server” app (package richdocumentscode) before version 26.4.303. Exploitation is possible only while the built-in CODE server is not running, for example during a restart, upgrade or after a crash.
Standalone Collabora Online servers are not affected, according to the vendor. If you buy Nextcloud as a hosted service, ask the provider to confirm whether this specific Built-in CODE app was used.
What should you do now?
Ask your IT provider today to determine whether your Nextcloud environment uses the richdocumentscode app. If it does, update it to version 26.4.303 or later; using the current supported release is preferable.
Simply disabling the app is not sufficient. For Nextcloud 29 or earlier, the vendor requires an upgrade of Nextcloud or removal of the app. If the installation was internet-accessible from 10 September 2026, commission a compromise assessment as well.
How urgent is it?
Very urgent for affected installations: exploitation is confirmed, no login is required and the flaw can execute commands on the server. Organisations that do not use the affected app need take no action; the priority is to verify the exact deployment promptly.
Information for your IT provider
CVE-2026-110447; CVSS v4.0: 9.2 (Critical).
Affected: richdocumentscode < 26.4.303. Fixed in 26.4.303 and later.
Prerequisite: the Built-in CODE server is not running, for example during a restart, upgrade or after a crash.
Attack path: /apps/richdocumentscode/proxy.php?status; no authentication or user interaction required.
Observed indicators: PHP files matching shx*.php, source IP 139.28.18.122, webhook.site and SHA-256 4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562.
Standalone Collabora Online is not affected. Disabling the app alone is insufficient; update or remove it.
